SSL certificates are one of those things that seem simple on the surface — every website needs one, they show the padlock in the browser, they're handled by your host — but the details matter more than most people realise.
Choosing the wrong type of SSL certificate can affect your user trust, your compliance obligations, and even your search ranking. Choosing the right one is straightforward once you understand what the different types actually provide.
What an SSL Certificate Actually Does
An SSL (Secure Sockets Layer) certificate — more accurately called a TLS certificate today, though "SSL" remains the common term — does two distinct things:
- Encryption — It enables HTTPS, encrypting the connection between a visitor's browser and your web server. This prevents third parties from intercepting data in transit.
- Authentication — It proves that your website is operated by a legitimate entity, not an impersonator. The level of authentication varies significantly by certificate type.
Without SSL, data transmitted between your website and visitors (login credentials, form submissions, payment details) is sent in plaintext. This is unacceptable for any modern website — and Google has confirmed it affects search rankings.
The Three Types of SSL Certificate
SSL certificates are classified by the level of validation the Certificate Authority (CA) performs before issuing them:
Domain Validated (DV) SSL
The CA verifies only that you control the domain. No business identity checks are performed.
- Validation time: Minutes to hours
- Shows in browser: Padlock only
- Best for: Personal sites, blogs, development environments, non-transactional websites
Organisation Validated (OV) SSL
The CA verifies your domain control and that your organisation is a legitimate, registered business entity.
- Validation time: 1–3 business days
- Shows in browser: Padlock; organisation details visible in certificate
- Best for: Business websites, informational sites, any site representing a company
Extended Validation (EV) SSL
The most rigorous validation — the CA performs comprehensive checks on your business: legal existence, physical address, operational status, and identity of the authorising contact.
- Validation time: 3–10 business days
- Shows in browser: Padlock; organisation name visible in some browsers
- Best for: E-commerce, financial services, healthcare, any site handling sensitive transactions
| Feature | DV SSL | OV SSL | EV SSL |
|---|---|---|---|
| Domain control verified | ✓ | ✓ | ✓ |
| Business identity verified | ✗ | ✓ | ✓ (extensive) |
| Encryption strength | Same | Same | Same |
| Validation time | Minutes | 1–3 days | 3–10 days |
| Recommended for | Personal sites | Business sites | E-commerce/finance |
Single Domain, Wildcard, and Multi-Domain SSL
Beyond validation type, SSL certificates also differ in how many domains and subdomains they cover:
Single Domain SSL — Covers one domain only (e.g. www.yoursite.com). The most straightforward option for sites with a single web presence.
Wildcard SSL — Covers a domain and all its subdomains (e.g. *.yoursite.com — covering shop.yoursite.com, blog.yoursite.com, etc.). Ideal if you run multiple subdomains.
Multi-Domain (SAN) SSL — Covers multiple distinct domains under a single certificate. Efficient if you manage several domains and want consolidated certificate management.
| Certificate Type | Covers | Best For |
|---|---|---|
| Single Domain | 1 domain | Simple single-site businesses |
| Wildcard | 1 domain + all subdomains | Businesses with multiple subdomains |
| Multi-Domain (SAN) | Multiple distinct domains | Businesses managing several domains |
Does SSL Affect SEO?
Direct: Google confirmed HTTPS as a ranking signal in 2014, and has incrementally increased its weight since. Sites without SSL are marked "Not Secure" in Chrome, which increases bounce rates and signals low quality to search engines.
Indirect: An insecure site erodes user trust. Higher bounce rates, lower dwell time, and fewer conversions all feed back into search ranking signals.
For any website serious about search performance, SSL is non-negotiable.
SSL and Compliance
For websites handling personal data under UK GDPR, POPIA, or PCI DSS (for payment card data), SSL is not optional — it's a requirement:
- UK GDPR / POPIA — Requires "appropriate technical measures" to protect personal data. Transmitting data over unencrypted HTTP is indefensible.
- PCI DSS — Payment card industry standards explicitly require HTTPS/TLS for any page handling card data.
Which Certificate Do You Need?
| Website Type | Recommended SSL |
|---|---|
| Personal blog or portfolio | DV — fast and sufficient |
| Small business informational site | OV — establishes business legitimacy |
| E-commerce store | OV or EV — customer trust is critical |
| Financial services | EV — highest trust signal available |
| Site with multiple subdomains | Wildcard DV or OV |
| Multiple distinct domains | Multi-domain (SAN) |
When in doubt, OV is the sensible default for any business website. It takes a little longer to issue but provides the authentication that DV cannot.
Conclusion
An SSL certificate isn't just a green padlock — it's a combination of encryption, business authentication, and trust signal that affects your security posture, your compliance obligations, and how search engines and users perceive your site.
EDZNET's SSL certificates are fully managed — we handle installation, configuration, and renewal so you never have to worry about an expired certificate.
